vCISO Client-in-a-Box

Everything you need to run a professional vCISO practice without paying $10K–$40K/month for platforms like Cynomi, GetCybr, or Drata. One workbook, 20 client slots, zero recurring fees.

The architecture is built around a single data flow: score a client's 22 NIST CSF 2.0 categories → their maturity rolls up to the Portfolio Dashboard → their hours roll up to utilization → their retainer rolls into MRR. Everything connected, nothing manual.

Portfolio Dashboard — 6 KPIs (Total Clients, Active, Onboarding, Renewals Due, Avg Portfolio Maturity, Total MRR) and a 20-row live table with Risk Flag indicators (⚠ HIGH / ● Medium / ✓ Healthy) computed from maturity × open risks. What you show on your Monday planning call.

Client Register — 16 columns per client, 20 slots, pre-seeded with 6 realistic examples across healthcare, SaaS, legal, manufacturing, education, and real estate — showing different tiers and frameworks so you see the pattern immediately.

Client-01 through Client-20 (20 identical templates, 5 sections each): Snapshot auto-populated from the Register; Maturity Assessment covering all 22 NIST CSF 2.0 categories with current/target/gap scoring and per-function rollups; Risk Register with Likelihood×Impact scoring (1–25); 12-Month Roadmap (12 initiatives with function/quarter/effort/cost/outcome/status); Engagement Cadence & Hours Log with billable tracking.

Framework Crosswalk — all 22 NIST CSF 2.0 categories mapped to SOC 2 TSC, ISO 27001:2022 (Annex A), HIPAA Security Rule (164.xxx references), PCI DSS 4.0.1, and CIS Controls v8. Score once, speak to any framework.

Also includes: Tier Model reference pricing (Strategic $10–15K/mo through Project $15–75K fixed), copy-paste QBR Template (9 sections), and 17-term Glossary.

Includes the 20-section, 584-paragraph Practitioner User Guide — the standout sections are the five-question scoring conversation pattern (Section 7) for running maturity assessments, utilization interpretation bands that tell you exactly when to lean in or have a scope conversation (Section 11), healthy book composition targets — 40–50% Strategic, 30–40% Standard, 10–15% Retainer, 5–10% Project (Section 13), and the 90-minute QBR structure with 30/30/30 time allocation and implicit renewal framing (Section 14). Also covers white-label deployment, monthly/quarterly/annual cadence cycles, and a full framework crosswalk disclaimer (conceptual mapping, not certification equivalency).